CVE-2025-32028
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
CRITICAL 9.9EPSS 2.0%
HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.
- Affected
- haxtheweb · issues
- CVSS v3.1 GITHUB
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 2.00% chance of exploitation in the next 30 days, 80th percentile
- Published
- 2025-04-08